…nfig/app-demo test coverage, workspace commands

…dy-mode rename, Internal->500, scaffold CI checks

… roadmap update, macro crate test

Match the edgezero-cli precedent and the workspace-dependency
convention. Adds quote to [workspace.dependencies].

…veat

- emit `include_bytes!` const in app! output so edits to edgezero.toml
  trigger a Cargo rebuild without requiring a .rs change
- strengthen middleware_sees_introspection_data to assert manifest_json
  presence and non-empty route list, mirroring dispatch test
- add content-type assertion to routes_lists_registered_routes
- add security caveat to routing.md Introspection Routes section noting
  endpoints are unauthenticated and environment.variables values are emitted

… no edgezero.toml change)

…p! untouched)

… atomic #[action(manifest|routes)] TDD tasks

…lity inject); fix plan single-filter cmd + probe response

…ne; cargo test in Task 10a

…rrying handler struct

…tale comment

Design spec for two upstream edgezero-core/edgezero-macros primitives:
- State<T> extractor + RouterBuilder::with_state for app-owned shared state
- nested/array #[secret] support via path-qualified SecretField metadata

Filed under docs/superpowers/specs/. Includes a maintainer-review appendix
(§8) verifying every current-mechanics claim against origin/main @ 42843b1
and folding in the corrections found: http-facade use in the router plumbing,
the inaccurate lib.rs re-export step, the omitted validate_excluding_secrets
consumer (needs nested-ValidationErrors navigation, not a rename), the
per-struct guard-enforcement rewording, and B-3 being forced to the
secret_fields() fn lowering.

…tate

- handlers.md: app! allows only one state=<expr> (macro rejects duplicates);
  use an aggregate app-state struct for multiple values. Fix stray '>' typo.
- fastly.md: get_tls_ja4() returns Option<&str>; Ja4 wraps String -> .to_owned().
- p0d plan: model the cached OnceLock<Arc<_>> app_state (was fresh Arc per call).

… model

- cli-reference.md / cli-walkthrough.md: bundled `edgezero config push` errors
  (no raw push); typed push writes ONE BlobEnvelope with every field verbatim,
  including #[secret] key NAMES — nothing is flattened or stripped. Correct the
  per-adapter mechanics to one (key, envelope_json) entry and fix the stale
  Fastly command (config-store-entry update --upsert --stdin).
- blob-app-config-migration.md: C::SECRET_FIELDS -> C::secret_fields().
- fastly.md: client IP is carried via FastlyRequestContext (only JA4/H2 need the
  raw hook); fix import path to context::FastlyRequestContext.

- axum.md: the local file is { "<store_id>": "<BlobEnvelope JSON>" }, not a
  flat per-leaf map; secret key names are preserved (never stripped/resolved).
  Show the AppConfig<C> extractor as the reader; drop the flat store.get example.
- cli-walkthrough.md: Spin secret note + env-overlay example — push preserves
  secret key NAMES and writes the nested blob, it does not strip secrets.
- axum config_store.rs: module + method doc comments describe the envelope
  entry (outer map still string->string; typed push writes one envelope string).

- spin.md / manifest-store-migration.md: use <your-cli> config push (bundled
  edgezero config push errors by design; typed push runs from the app CLI).
- axum.md + axum config_store.rs: the outer blob key is the *selected* config
  key — defaults to the logical store id, overridable with --key.
- axum config_store.rs: add generated_at to the BlobEnvelope example (required
  field), matching the fuller shape in the public Axum docs.

… selector

- cli-reference.md: add the shipped `config diff` command (typed-only; --format
  unified/json/structured, --exit-code, --key/--store/--local/--no-env/etc.), and
  document the config push flags that were missing: --key, --no-diff, --yes/-y.
- manifest-store-migration.md: EDGEZERO__STORES__CONFIG__<ID>__KEY is a concrete
  runtime blob selector (staging/canary), not free-form tuning — dedicated table
  row + note; disambiguate the free-form row's metavariable to <SUFFIX>.
- configuration.md: mention the __KEY selector next to __NAME so operators find it.

…-secrets-spec-review

# Conflicts:
#	crates/edgezero-cli/src/bin/check_no_nested_app_config.rs
#	crates/edgezero-core/src/handler.rs
#	crates/edgezero-core/src/router.rs
#	crates/edgezero-macros/src/app.rs

CI resolves prettier ^3.4.2 to 3.8.3, which normalizes list spacing more
strictly than the 3.4.2 I formatted with locally — remove the stray blank
line in the Spin push bullet so format-docs passes.

…-cycles

Address PR review findings (all non-blocking):

- secret_walk / collect_secret_leaves: `field.optional` reflects only the LEAF
  (`Option<String>`); a missing/null intermediate object/array is now a
  ConfigOutOfDate error in BOTH the runtime and CLI walkers, not a silent skip
  that degraded to a vaguer serde error. Re-aligns the two walkers.
- secret_walk: skip `StoreRef` fields at the loop top (they hold a store id, not
  a key) — avoids a wasted full-path descent before discarding.
- derive: reject DIRECT self-cyclic `#[app_config(nested)]` at compile time
  (new trybuild UI fixture). Mutual A<->B cycles are undetectable by a
  proc-macro (one type at a time) — documented.
- check_no_nested_app_config footer + configuration.md: opt-in supports `T` /
  `Vec<T>` only (not Option/Box wrappers); document required-intermediate and
  cyclic-nesting semantics.
- tests: optional-leaf-absent + missing-required-intermediate for both walkers.